Tag Info

Hot answers tagged

8

"and the demo website wouldn't let me log on, which doesn't engender extreme confidence" ouch.. I am the developer of Snorby and i'll bet 100 USD you were typing "snorby@snorby.com" (try .org). I have never had one issue with authentication or demo downtime since the launch of Snorby 2.x.x. Please make sure you verify credentials thoroughly before you post ...


7

Sensor placement can be very tricky as there are loads of variables to consider. At minimum, you should take into account Classification level of monitored resource Network design System throughput Personnel time (for management and analysis) Resource availability Throwing all of those into a blender and turning on high for a few minutes will give you ...


7

That's a very general question. Your concern should not just in relation to Snort, it all depends on the platform that you install it on (o/s - yes it does run on Windows, CPU, memory etc) and what elements (pre-processors for fragmentation or stream reassembly) of Snort that you enable (look in the configuration file, typically /etc/snort.conf, for more ...


6

There are two subtly different things you might want to test. Is Snort working in the sense that it's running, able to sniff trafic, testing it against the rules, and alerting you when one is triggered? Is Snort working in the sense that it's current rule set detects a specific intrusion of type X? To test case 1, you make a rule that's easy to fire, ...


6

Web application firewalls like mod_security have the potential to be more effective than network-based IDSs like Snort, because a web firewall can see the request exactly as it will be handled by the web server, and a network-based IDS cannot. Network-based systems, like Snort, can only see the network packets. They have to infer/guess how the web server ...


6

Those numbers are a combination of unique identification and data source. Each Snort signature is identified by a SID (Signature ID) and a revision number. The SID is used to uniquely identify that specific signature and the revision is the edit number of that signature. So the original signature is rev:1;, then if it gets updated then incremented to rev:2; ...


5

It also might be worth taking a look at IDSWakeUp. IDSwakeup is a collection of tools that allows to test network intrusion detection systems. The main goal of IDSwakeup is to generate false attack that mimic well known ones, in order to see if NIDS detects them and generates false positives. Like nidsbench, IDSwakeup is being published in ...


5

0000000: 00 01 72 6f 75 74 65 72 2e 63 6f 6e 66 00 6e 65 74 61 73 63 69 69 00 ..router.conf.netascii. That's probably a router, requesting the router.conf file in netascii encoding. 0000000: 00 01 42 6f 6f 74 5c 78 38 36 5c 77 64 73 6e 62 70 2e 63 6f 6d 00 6e 65 74 61 000001A: 73 63 69 69 00 ..Boot\x86\wdsnbp.com.netascii. That's a Windows PE attempt at ...


5

Absolutely. Specifically "promiscuous" mode is just a flag on the network stack that passes all packets seen on that interface up to the application layer. Using snort as an example, this is often how one will properly monitor multi-homed systems. One NIC monitoring each uplink. Using snort as your IDS, please be careful with how it handles interface ...


5

The attacker was trying to exploit the CVE-1999-0081 vulnerability of unpatched WU-FTPD installations, where a software bug allows RNFR Rename From commands to overwrite or rename files, even if these commands are violating file permissions and when an unescaped input parameter using relative path pointing to directory root (././) is used. The following ...


5

The Bad News Not directly, not in the way you want. You can specify multiple alert outputs, as described in the Section 2.6 of the manual. However, this will simply send the same alerts to multiple locations. You'll still have alerts from signatures imported from both ddos.rules and log.rules logged together. The Good News Fear not, we can make it work. ...


4

NOOPs are the tip-off for the snort rules. A file transfer is likely not to have NOP slides, but in this case, it might be a false positive: WANG2..JFIF What you may have here is a ping from one Windows machine to another. Part of the ping payload is a jpg of the word: Microsoft. This type of traffic has triggered other people to be suspicious, as well. ...


4

For OSSEC you can generate new keys for every agent that will be reporting to the OSSEC server installed in the OSSIM server (check Analysis | Detection | HIDS) For Snort, the most easy and recommended way is install an OSSIM sensor profile, that comes with the Snort up and provides you the new rules using the command alienvault-update But if you are not ...


4

IPS like Snort are more of generalists for protecting commonly used Internet Protocols like HTTP, DNS, FTP, SMTP etc. WAFs are supposed to be specialists for protecting HTTP. Just to take injection attacks like SQLi, XSS as a starting point: You can take some or all of mod_security's signatures and attempt to write equivalents for snort. However, IPS ...


3

To test that your default rules are working, assuming you've pulled them down with pulledpork, oinkmaster or something-else, you can simply browse to http://testmyids.com/ from a client whose traffic will be seen by the IDS, through your IDS device being inline or as a port span. The http response contains the following text - uid=0(root) gid=0(root) ...


3

I realize that this already has an accepted answer but this is a quick summary of how to set this up. snort.conf output alert_syslog: LOG_DAEMON LOG_ALERT rsyslog.conf daemon.* @alienvault-server ossim_setup.conf detectors=...,snort_syslog,... snort_syslog.cfg location=/var/log/daemon.log


3

If you have Cisco networking equipment you can use Catalyst Switched Port Analyzer (SPAN) to mirror traffic from a port to another one which you have your snort sensor on. Their is a Cisco SPAN Configuration example at http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a008015c612.shtml. Other networking equipment has similar ...


3

For sake of argument, let's assume you're referring to the rule mentioned by Mark in his comment. This works out well since when doing a full text search of your quoted text across all VRT and ET rules, it's the only one I found as well. It is sid 1390, found in the file shellcode,rules for those keeping track at home. The full rule text is: alert ip ...


3

Just incase anyone stumbles across this in the future, further down the conf file there are other lists, all of which are contained in square brackets. For listing ports, you seperate these with commas. For listing IP addresses, you seperate these with commas also, however you need to put down the IP address, followed by a slash, followed by the base. So ...


3

The key thing you need is ground truth. You need an a priori way to know which parts of the traffic are in fact attacks, and which are not. Once you have ground truth, then building the confusion matrix is straightforward. For each attack in the traffic, you check whether Snort detected the attack or not (this gives you a count of True Positives and False ...


3

Using mod_security as a reverse proxy is common, especially in the IIS world where only recently has a free WAF has become available. Apache running as a reverse proxy will handle your SSL handshakes, so this won't be a problem. However it sounds like you have a MUCH BIGGER PROBLEM on your hands. If you can't update Apache you are completely and ...


3

Basically, snort observes network packet traffic. It can be configured to log and/or report on any information that is available from the network packet. In most cases it is only trapping on frame and header data, but it can also be used for a fairly robust set of deep packet inspection (DPI) functions. DPI allows you to sort/track/trap/etc based on ...


3

If you set the network type to your virtual machines to Internal Network with the same internal network name (an arbitrary string of your choosing, but the same for all machines), and then configure (in the Advanced settings) the promiscuous mode to Allow All, then the VM will be all hooked to a virtual hub which is like a switch which mirrors everything ...


3

Snort doesn't support wildcards or regular expressions on IP addresses/ranges. It does support CIDR notation for IP ranges, a few pre-configured variables in snort.conf like $HOME_NET and similar, and a ! for IP or IP range negation (edit: Oh, and of course any, but not !any). What you could do however is to define a new ipvar variable, fill it with the ...


3

Configured properly, you shouldn't be able to detect snort. "Properly" means on an unconfigured/no-address-assigned port in promiscuous mode. As PTW-105 mentioned, if snort is configured to send resets then maybe you can detect it, but more likely, you'd detect that something was blocking you. The same holds true if it's in inline mode. Two things I can ...


2

I'm going to answer both your questions in a kinda non-specific way, but bear with me. Your first question is "I'm putting in an IDS, what should I tell it to do?" Well, you're doing it backwards, but don't worry - this is a common security confusion. An IDS, like any security system, is not a magic wand. You don't just install it and everything's hunky ...


2

Sensor placement can be very tricky as there are loads of variables to consider. At minimum, you should take into account Classification level of monitored resource Network design System throughput Personnel time (for management and analysis) Resource availability Throwing all of those into a blender and turning on high for a few minutes will give you ...


2

I think libpcap and/or tcpdump are what you're looking for. Kismet is a wireless analyzer that will display the 802.11 metadata. There was some activity awhile ago to add 802.11 intrusion detection capabilities (snort-wireless). You might still find useful remnanats of that. Kismet pulls the 802.11 frame data and analyzes that, then examines some of the ...


2

There are two reasons: First, anomaly-based network intrusion detection is harder to translate from research into practice than it might at first seem. It tends to raise many false alarms. Second, those are research papers. Researchers often build a research prototype that's just good enough to test the idea (as a proof of concept). There's a great deal ...


2

Snort supports several output formats for the Log Parser where CSV format is mostly used. To configure Snort to use the CSV output format add the following line in the snort.conf file: output alert_csv: alert.csv default There are by default 28 fields available for log analysis that include timestamp, sig_generator, sig_id, sig_rev, msg, proto etc. ...



Only top voted, non community-wiki answers of a minimum length are eligible